CZ Warns Crypto Firms of North Korean Hacker Threats

Binance founder Changpeng Zhao (CZ) has issued a warning to crypto projects about North Korean ￰0￱ detailed how the group is using increasingly sophisticated tactics to gain access to ￰1￱ Are Exploiting Hiring Process CZ shared his concerns via a September 18 X post, describing the hackers as “advanced, creative, and patient.” He explained how the most common method used by these individuals involves posing as job candidates to secure roles in companies, particularly in developer, security, and finance positions, giving them a “foot in the door.” In other cases, the group poses as employers and attempts to interview staff, using the process to distribute ￰2￱ noted that during these sessions, the attackers often claim there is a problem with Zoom and then send a link to an “update” carrying a virus, or they provide coding questions followed by “sample code” embedded with ￰3￱ tactic involves pretending to be users who file customer support requests containing malicious ￰4￱ added that hackers also pay or bribe employees and hired vendors to gain access to data, pointing to a recent case in India where an outsourcing service was compromised, resulting in the leak of data from a major ￰5￱ and losses exceeding $400 ￰6￱ alert follows the release of a report by cybersecurity group Security Alliance (SEAL), profiling over 60 impostors linked to North Korean ￰7￱ report says that these attackers built fake LinkedIn profiles, set up GitHub portfolios, and used forged government IDs to make their applications look ￰8￱ in Methods North Korean hackers have always been a major threat in the crypto industry, with over $1.3 billion worth of assets stolen in 2024 alone.

Traditionally, they have relied on phishing, malware, and private key compromises to loot from exchanges. However, recent reports suggest they are moving towards targeting human resources. A separate investigation by ZachXBT also uncovered how a small DPRK team of five IT workers operated over 30 fake identities at crypto firms. Elsewhere, Coinbase also recently reported a similar threat from these bad ￰9￱ exchange shared that they are increasingly targeting their remote worker policy to infiltrate sensitive ￰10￱ Brian Armstrong has since announced changes to the company’s internal security protocols, including mandatory in-person onboarding in the U.

S., fingerprinting, and ￰11￱ requirements for employees with system-level ￰12￱ exchange also introduced stricter interview procedures, such as requiring cameras to remain on, to prevent impersonation and AI-assisted ￰13￱ light of the growing threat to the job market, CZ has urged crypto platforms to train their employees not to download files and to screen potential candidates carefully.